US20170293764A1 - Statistical analytic method for the determination of the risk posed by file based content - Google Patents
Statistical analytic method for the determination of the risk posed by file based content Download PDFInfo
- Publication number
- US20170293764A1 US20170293764A1 US15/634,654 US201715634654A US2017293764A1 US 20170293764 A1 US20170293764 A1 US 20170293764A1 US 201715634654 A US201715634654 A US 201715634654A US 2017293764 A1 US2017293764 A1 US 2017293764A1
- Authority
- US
- United States
- Prior art keywords
- categories
- electronic file
- checks
- risk assessment
- threat
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2457—Query processing with adaptation to user needs
- G06F16/24578—Query processing with adaptation to user needs using ranking
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/285—Clustering or classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
- G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
- G06F2221/034—Test or assess a computer or a system
Definitions
- This invention relates to computer file-based security in general and more specifically to the potential risk contained within commonly communicated file formats.
- Malware such as viruses, Trojan horses, and other malicious content
- the traditional approaches of constructing signatures to identify these threats is becoming more and more difficult given the rate at which new variants of malware are emerging.
- the challenge associated with using the signature-based methods is that the problem of “looking for bad” is an unbounded one.
- the approach is always behind the latest, and most dangerous, threats.
- An additional issue is that these approaches often create a lot of “noise” in the form of false positive identification of benign content without providing any actionable insight into the potential issue to allow an individual tasked with securing the organization to be able to make an informed decision.
- Electronic sandbox 115 is an appliance that can open electronic file 105 in total isolation.
- Electronic sandbox 115 can be a computer system that is physically isolated (or isolated as completely as possible) from any intranet, so as to prevent the migration of any malicious code.
- electronic sandbox 115 can be a virtual environment in a computer system, ideally isolated from any other environments on the same computer system (or other networked computer systems).
- electronic sandbox 115 By using electronic sandbox 115 , the dangerous effects of any malicious code in electronic file 105 are strictly confined to the sandbox environment, which is typically discarded for a fresh instance of the environment when the next file is processed. If opening electronic file 105 in electronic sandbox 115 does not demonstrate the presence of any malicious code, then electronic file 105 is likely not a threat, and can be delivered to user 120 . On the other hand, if the opening of electronic file 105 in electronic sandbox 115 demonstrates the presence of malicious code, then electronic file 105 can be placed in quarantine 125 until either electronic file 105 can be cleansed somehow of the malicious code, or electronic file 105 is deleted.
- the problem with using electronic sandbox 115 in this manner is that it requires considerable overhead to maintain electronic sandbox 115 and to monitor electronic sandbox to determine if electronic file 105 contains malicious code.
- monitoring electronic file 105 within electronic sandbox 115 adds considerable latency to the delivery of electronic file 105 to the user.
- attackers are aware of the use of electronic sandbox 115 . By delaying the activation time of their malicious code until after the inspection time of electronic sandbox 115 , the observation of electronic sandbox 115 might fail to detect the malicious code. As a result, electronic file 105 might be delivered to user 120 as safe, even though it contains malicious code.
- Embodiments of the invention address this and other problems with the prior art.
- FIG. 1 shows an example of protection against malicious content in the prior art.
- FIG. 2 shows the electronic sandbox of FIG. 1 , augmented by a system designed to calculate a risk assessment for an electronic file, according to an embodiment of the invention.
- FIG. 3 shows more detail about the scanner of FIG. 2 , according to an embodiment of the invention.
- FIG. 4 shows details of the database of FIG. 3 .
- FIG. 5 shows details of the threat calculator of FIG. 3 .
- FIG. 6 shows details of the analyzer and statistical analyzer of FIG. 3 when used in analysis mode.
- FIG. 7 shows a flowchart of a procedure for calculating a risk assessment for an electronic file in the system of FIG. 3 , according to an embodiment of the invention.
- FIG. 8 shows a flowchart of alternatives to the procedure for calculating a risk assessment of FIG. 7 , according to a second embodiment of the invention.
- FIGS. 9A-9B show a flowchart of a procedure for calculating weights used in the procedure of FIG. 7 .
- FIGS. 10A-10B show a flowchart of a procedure for determining whether to use an electronic sandbox in the procedure of FIG. 7 .
- the content of the electronic file is examined to see if the content conforms to the pre-determined format. If the content conforms to the pre-determined format, then the content is permitted to pass through for delivery to the user. Otherwise, the content is quarantined.
- the content whether conforming or not, can also be re-generated. Re-generation of content can further help to prevent malicious content from slipping through, by recreating the content in the pre-determined format.
- the re-generated electronic file ideally is structurally identical to the original file, but absent any metadata that is not required.
- Embodiments of the present invention provides an anti-malware content data management apparatus, which provides malware protection as well as insight into the threat posed by an electronic file by approaching the problem from an alternate viewpoint.
- the viewpoint of definable good is a bounded problem in the sense that what is known to be good for a particular file format does not change compared to trying to keep pace with the ever changing definition of known bad. It is possible to determine the goodness of files that are defined as passive: i.e., files that do not contain active of program code within them. These files are the typical files that organizations communicate on a daily basis. But these files are also the files in which new waves of attacks tend to hide within.
- embodiments of the present invention produces a score related to the type of content that the file in question contains, as well as the perceived risk based on historical statistics skewed with a configurable weighting factor.
- This approach deviates from the traditional and known art, which only provides a safe/unsafe binary answer as to the files credibility.
- Embodiments of the present invention extends this by providing shades of grey, to allow individuals and indeed further decision making processes to blend this information into the overall decision making process for that particular file or content thus increasing the accuracy of malware detection, as well as reducing the false positive rate.
- the systems and methods described herein add a secondary layer of analytical processing over and above the approach of evaluating a file based on its conformity to known good content, which provides a binary outcome in the sense that the file is either conforming or non-conforming.
- This additional layer on top of this binary process allows a third outcome to an implementation whereby the original, un-sanitized version of the document is allowed to be delivered to a recipient if it is deemed a low risk.
- Examples of systems that can incorporate embodiments of the claimed invention can include the realization of an e-mail protection system whereby decisions around whether a file, typically an attachment, should be quarantined or not can be enhanced by the analytical scoring capability.
- SME Small/Medium Enterprise
- MSSP Managed Service Security Providers
- An automated process can be released whereby quarantined files can be subject to much more colored decision making and managed in a much more streamlined and cost effective manner.
- MSSP provider can remotely adjust the weightings applied to the categories to increase or decrease the importance of an associated content group on the decision making process depending on the current threat landscape and the importance of this content in the mitigation of any new and current attacks.
- Examples also include the implementation of an optimized sandbox process, which typifies the process whereby suspicious files received by an organization across a number of potential ingress point are opened, or commonly referred to as “detonated” within a controlled environment whereby any potential malware contained within said file is unable to cause any damage or spread to other environments.
- the current state of the art sandbox process typically observes the file for around five minutes to ascertain whether it is likely the file will perform any malicious act before then either quarantining the file or allowing it to pass on to its intended recipient. The issue with this approach that every file is processed and subject to a delay of this nature, causing significant processing overhead and bandwidth usage.
- Embodiments of the invention optimize this process because electronic files can be scored based on the content groups contained within and by setting a threshold before the file is placed in the sandbox. If the score for the electronic file is sufficient, the sandbox can be bypassed, alleviating the necessity on every file being “detonated” by the sandbox. The sandbox infrastructure can then focus its full resources on only the files that need to be scanned as they have scored above (or below, depending on the implementation) the threshold, suggesting that there is a reason for further investigation.
- FIG. 2 highlights how embodiments of the invention addresses these drawbacks in sandbox implementations.
- Electronic file 105 can be submitted to an embodiment of the invention, as represented by scanner 205 , which can be inline before sandbox 115 .
- the process of statistical scoring can be applied to electronic file 105 to ascertain whether electronic file 105 can be regenerated or not. If electronic file 105 can be regenerated because it is conformant as specified by the rules relating to the format of electronic file 105 , then the regenerated file can bypass sandbox 115 and be delivered to user 120 through whichever vector is appropriate.
- Embodiments of the invention therefore have the effect of acting as a noise filter and only requiring sandbox 115 to be instantiated on a limited number of files that have issues that have non-conformancy problems or those that have an associated policy violation. It should be obvious to those skilled in the art that this optimizing filter has considerable benefit to the overall process in terms of both performance and overhead.
- file conformancy policies can be drafted directly in scanner 205
- network connection 110 can also be used to remotely administer file conformancy policies. These policies determine the type of non-conformances within a file that will cause scanner 205 to deem the file as non-conforming and therefore forward the file to sandbox 115 .
- load balancing can be realized, whereby during times of peak demand or indeed peak malware activity the bias between delivering an electronic file directly to user 120 or detonating electronic file 105 in sandbox 115 can be varied.
- These polices can be determined based on organizational preference of state and mediated by current malware activity.
- FIG. 3 shows more detail about the scanner of FIG. 2 , according to an embodiment of the invention.
- Scanner 205 can include a computer 305 , which can be suitably programmed to implement embodiments of the invention.
- computer 305 can include special-purpose components designed to implement embodiments of the invention.
- Computer 305 can include receiver 310 , analyzer 315 , and threat calculator 320 .
- Receiver 310 can receive data, such as the electronic file being examined, or weights used for categories of checks.
- Analyzer 315 can analyze an electronic document to see if the content of the electronic document conforms to the format of the electronic document. As described above, the checks associated with determining whether content is known to be good can be organized into various categories. There can be thousands of checks, organized into various categories. Analyzer 315 uses these checks, as organized, to determine whether the electronic file conforms to the format expected for the electronic file. Analyzer 315 can produce a report that identifies which checks do not return the expected results, and to which categories those checks belong.
- Threat calculator 320 can then take the output of analyzer 315 and calculate a threat score for the electronic document. For each issue identified by analyzer 315 , threat calculator can identify the corresponding weight and calculate the overall threat score by summing the products of the number of times an issue was found and the weights associated with that issue. This sum can then be compared with a threshold to determine whether the electronic file is considered to be at risk or not.
- FIG. 3 shows sandbox 115 as part of scanner 205 : a person skilled in the art will recognize that sandbox 115 can be implemented as software, in which case any suitable computer can implement the software for sandbox 115 . In that case, sandbox 115 can be part of computer 305 . But sandbox 115 can be separate from scanner 205 , as shown in FIG. 2 : sandbox 115 can be implemented as part of a separate computer, or as a special-purpose machine, either of which can be sufficiently isolated to prevent any malicious code in the electronic file from achieving its intended purpose.
- Computer 305 can also include statistical analyzer 325 .
- analyzer 315 can be used in analysis mode, operating on sets of known files.
- Statistical analyzer 325 can then process the results of these analyses to establish initial weights for use in determining whether an electronic file is considered to be a threat.
- Computer 305 can also include memory 330 .
- Memory 330 can be used to store information: for example, a copy of the electronic file being scanned by the system.
- Memory 330 can also store database 335 , which can include information about the checks used to verify that the electronic file conforms to its purported file format.
- FIG. 4 shows more detail about database 335 .
- database 335 is shown as including data in three columns.
- the three columns store categories, issues, and weights.
- database 335 shows two different categories 405 and 410 , five issues 415 , 420 , 425 , 430 , and 435 (divided between the two categories), and seven weights 440 , 445 , 450 , 455 , 460 , 465 , and 470 .
- weights can be assigned.
- category 1 405 has weight 1 440
- issue 1 415 associated with category 1 405
- has weight 2 445 For example, category 1 405 has weight 1 440 , whereas issue 1 415 (associated with category 1 405 ) has weight 2 445 .
- FIG. 4 actually shows different possible embodiments.
- the categories are assigned weights, rather than the individual issues.
- individual issues are assigned weights. Where the weights are assigned to categories, the number of issues in that category can be multiplied by the weight for the category. Where the weights are assigned to issues, the number of occurrences of each issue can be multiplied by the weight for that issue. Regardless of whether weights are per category or per issue, the sum of the products can then be computed, which represents the score for the electronic file.
- positive weights can be assigned to less significant issues and negative weights can be assigned to more significant issues, and a threat score that is less than the pre-determined threshold can indicate an electronic file is considered a threat.
- the use of weights of mixed signs can also impact the pre-determined threshold to use.
- the pre-determined threshold can be zero.
- FIG. 5 shows details of the threat calculator of FIG. 3 .
- a threat score can be calculated for an electronic file.
- Embodiments of the invention can check to see whether an electronic file conforms to its purported file format. For a given purported file format, checks can be performed to see if the electronic file meets the standard for that file format. If a particular check is not satisfied—that is, the electronic file fails to satisfy some element of the standard for that file format—then that issue is flagged as having occurred.
- Threat calculator 320 can take electronic file 105 and database 305 , and calculate risk assessment 505 (also called threat score, or simply score) for electronic file 105 . In one embodiment of the invention, risk assessment 505 is calculated by multiplying the number of occurrences of each issue by the corresponding weight for that issue, and summing the products.
- weights are assigned to categories rather than to individual issues.
- the system can calculate the number of occurrences of issues in each category based on the individual checks. This number can then be multiplied by the weight assigned to the category for use in the calculation of risk assessment 505 similar to the discussion above.
- analyzer 315 can run not only in a scanning mode but also in an analysis mode. In analysis mode, analyzer 315 can take files that are known, analyze those files, and generate weights from the analysis.
- FIG. 6 shows details of the analyzer and statistical analyzer of FIG. 3 when used in analysis mode.
- analyzer 315 can receive two corpuses of files, such as corpus 605 and 610 .
- Analyzer 315 can then analyze corpuses 605 and 610 , and produce results 615 and 620 .
- corpus 605 can include files that are known to include malicious content
- corpus 610 can include files that are known to have issues but are otherwise not a threat.
- Statistical analyzer 325 can then process these results 615 and 620 to adjust the weights assigned to the categories or checks/issues when analyzing electronic documents in normal operating mode.
- Statistical analyzer 325 can use any desired algorithm to adjust weights. In some embodiments of the invention, the weights are adjusted until the threat scores for files in corpus 605 indicate a greater risk than the threat scores for files in corpus 610 .
- weights Even after initial weights have been determined, users might choose to adjust the weights. For example, one user of such a system might decide that macros included in a document are considered safe, even though macros can be used to achieve malicious results. Another user of such a system might decide that a misnamed font indicates a significant risk, even though the name of the font generally cannot be used to malicious impact. Thus, the default weights can be overwritten by users (or alternatively, at the user's direction, but by the manufacturer of the system).
- analyzer 315 in analysis mode can only occur to determine the initial weights used by the system.
- analyzer 315 is used in analysis mode only before the system is put into operation to protect a customer. But there is no reason that the results of analyzing an electronic file by analyzer 315 , even during use of the system to protect a customer, cannot be used to adjust the weights.
- the system can use these analyses as feedback to adjust the weights assigned to the categories or checks/issues. This feedback can occur in any desired manner.
- the feedback can be applied for each electronic file analyzed by analyzer 315 , regardless of the results of the analysis.
- the feedback can be applied only when a file is considered to be a risk, or when a file is considered to be safe.
- a person of ordinary skill in the art will recognize other ways in which feedback can be managed.
- FIG. 7 shows a flowchart of a procedure for calculating a risk assessment for an electronic file in the system of FIG. 3 , according to an embodiment of the invention.
- the system can receive an electronic file.
- the system can analyze the electronic file using various checks organized into categories.
- the system can determine weights for the various categories (or, alternatively as described above, the checks/issues themselves).
- the system can calculate a risk assessment or threat score for the electronic file, using the checks and categories, and the associated weights.
- the system can use the calculated risk assessment to adjust the weights, for example, in a feedback loop.
- FIG. 8 shows a flowchart of alternatives to the procedure for calculating a risk assessment of FIG. 7 , according to a second embodiment of the invention.
- weights can be assigned, not to the categories of checks, but to the checks themselves. Instead of blocks 710 , 715 , and 720 as shown in FIG. 7 , blocks 805 , 810 , and 815 can be substituted.
- the electronic file can be analyzed using individual checks.
- weights for the individual checks can be determined.
- the system can calculate a risk assessment or threat score based on the checks and the weights assigned to them.
- FIGS. 9A-9B show a flowchart of a procedure for calculating weights used in the procedure of FIG. 7 .
- the weights discussed in FIGS. 9A-9B can be either for the categories of checks or for the individual checks.
- weights can be assigned by the user.
- default weights can be assigned.
- the default weights can be adjusted by the user.
- weights can be calculated by analyzing known files.
- the system can receive corpuses of files. As described above, in some embodiments of the invention, one corpus can include files known to contain malicious content, and another corpus can include files with issues that are known not to be a threat.
- the corpuses of files can be scanned using the checks/categories of checks.
- the results of the analysis can be statistically analyzed.
- the default weights can be adjusted using the statistical analysis. Control can then return to FIG. 9A , where processing ends.
- FIGS. 10A-10B show a flowchart of a procedure for determining whether to use an electronic sandbox in the procedure of FIG. 7 .
- the system can calculate a threat score for an electronic file.
- the system can compare the threat score with a pre-determined threshold.
- the system determines if the threat score exceeds the pre-determined threshold. If so, then at block 1020 the electronic file is considered safe and at block 1025 the system can deliver the electronic file to the intended recipient.
- the system can note that the electronic file is not considered safe.
- the system can place the electronic file in a sandbox.
- the system can detonate the electronic file (in any appropriate manner), and at block 1045 , the system can observe the operation of the sandbox.
- the system determines if the electronic file appears to be a threat. If so, then at block 1055 , the system can quarantine the file until appropriate remedies can be applied. Otherwise, processing can return to block 1025 ( FIG. 10A ) to have the system deliver the electronic file to the intended recipient.
- FIGS. 10A-10B describe an electronic file as considered safe when the threat score exceeds the pre-determined threshold
- a person of ordinary skill in the art will recognize that the test for whether an electronic file is considered safe or not can depend on how the threat score is calculated. Thus, if positive weights are used for issues that are considered more significant, an electronic file can be considered safe if the threat score is less than a pre-determined threshold, and can be considered a risk if the threat score is greater than the pre-determined threshold.
- the machine includes a system bus to which is attached processors, memory, e.g., random access memory (RAM), read-only memory (ROM), or other state preserving medium, storage devices, a video interface, and input/output interface ports.
- the machine may be controlled, at least in part, by input from conventional input devices, such as keyboards, mice, etc., as well as by directives received from another machine, interaction with a virtual reality (VR) environment, biometric feedback, or other input signal.
- VR virtual reality
- the term “machine” is intended to broadly encompass a single machine, or a system of communicatively coupled machines or devices operating together. Exemplary machines include computing devices such as personal computers, workstations, servers, portable computers, handheld devices, telephones, tablets, etc., as well as transportation devices, such as private or public transportation, e.g., automobiles, trains, cabs, etc.
- the machine may include embedded controllers, such as programmable or non-programmable logic devices or arrays, Application Specific Integrated Circuits, embedded computers, smart cards, and the like.
- the machine may utilize one or more connections to one or more remote machines, such as through a network interface, modem, or other communicative coupling.
- Machines may be interconnected by way of a physical and/or logical network, such as an intranet, the Internet, local area networks, wide area networks, etc.
- network communication may utilize various wired and/or wireless short range or long range carriers and protocols, including radio frequency (RF), satellite, microwave, Institute of Electrical and Electronics Engineers (IEEE) 810.11, Bluetooth, optical, infrared, cable, laser, etc.
- RF radio frequency
- IEEE Institute of Electrical and Electronics Engineers
- Associated data may be stored on tangible computer-readable media as non-transitory computer-executable instructions.
- Associated data may be stored in, for example, the volatile and/or non-volatile memory, e.g., RAM, ROM, etc., or in other storage devices and their associated storage media, including hard-drives, floppy-disks, optical storage, tapes, flash memory, memory sticks, digital video disks, biological storage, etc.
- Associated data may be delivered over transmission environments, including the physical and/or logical network, in the form of packets, serial data, parallel data, propagated signals, etc., and may be used in a compressed or encrypted format. Associated data may be used in a distributed environment, and stored locally and/or remotely for machine access.
- Embodiments of the invention can extend to the following statements, without limitation:
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, for each of the plurality of categories, a weight assigned to the category, and for each of the plurality of checks, a second weight assigned to the check; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer, the weights assigned to the plurality of categories, and the second weights assigned to the plurality of checks.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the receiver is operative to receive the weights assigned to the plurality of categories from a user.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the weights assigned to the plurality of categories include default weights assigned to the plurality of categories, and wherein the receiver is operative to receive second weights from a user to assign to the plurality of categories.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the weights assigned to the plurality of categories include default weights assigned to the plurality of categories, wherein the analyzer is operative to analyze a first corpus of files with known non-conformities to produce a first result and to analyze a second corpus of safe files to produce a second result, and wherein the system further comprises a statistical analyzer to statistically review the first result and the second result and to adjust the default weights assigned to the plurality of categories so that a first calculated risk assessment for the first corpus of files
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, and a statistical analyzer to use the result from the analyzer adjust the weights.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the system is operative to deliver the electronic file to a second user if the calculated risk assessment is greater than a pre-determined threshold.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, and an electronic sandbox, the electronic file placed in the electronic sandbox if the risk assessment for the file does not exceed a pre-determined threshold.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, and an electronic sandbox, the electronic file placed in the electronic sandbox if the risk assessment for the file does not exceed a pre-determined threshold, wherein the system is operative to deliver the electronic file to a second user if an observed operation of the electronic sand box indicates that the electronic file is not a threat.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks from one of a plurality of categories to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of checks from one of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of checks from the one of the categories and the second weights assigned to each of the plurality of checks.
- An embodiment of the invention includes a method, comprising: receiving the weight assigned to each of the plurality of categories from a user; receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories, and adjusting the default weight assigned to each of the plurality of categories according to instruction from a user; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, wherein receiving a default weight to assign to each of the plurality of categories includes receiving a first corpus of files with known non-conformities and a second corpus of safe files, scanning the first corpus of files to produce a first result and the second corpus of files to produce a second result, statistically analyzing the first result and the second result, and using the analysis of the first result and the second result to adjust the default weight assigned to each of the plurality of categories so that a first calculated risk assessment for the first corpus of files is higher than a second calculated risk assessment for
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories; and using the final risk assessment of the electronic file to adjust the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, and if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user, and if the threat score does not exceed the threshold score, determining that the electronic file is likely a threat.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user, and if the threat score does not exceed the threshold score, determining that the electronic file is likely a threat, wherein determining that the electronic file is likely a threat includes placing the electronic file in a sandbox, detonating the electronic file in the sandbox, and observing the operation of the sandbox
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user, and if the threat score does not exceed the threshold score, determining that the electronic file is likely a threat, wherein determining that the electronic file is likely a threat includes placing the electronic file in a sandbox, detonating the electronic file in the sandbox, observing the operation of the sandbox after
- An embodiment of the invention includes a tangible computer-readable medium storing non-transitory instruction that, when executed by a machine, implement the method of receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
Abstract
Description
- This application is a continuation of U.S. patent application Ser. No. 15/082,791, filed Mar. 28, 2016, now allowed, which is a continuation of U.S. patent application Ser. No. 14/600,431, filed Jan. 20, 2015, now U.S. Pat. No. 9,330,264, issued May 3, 2016, which claims the benefit of U.S. Provisional Patent Application Ser. No. 62/084,832, filed Nov. 26, 2014.
- This invention relates to computer file-based security in general and more specifically to the potential risk contained within commonly communicated file formats.
- Malware (such as viruses, Trojan horses, and other malicious content) are becoming more and more prevalent. The traditional approaches of constructing signatures to identify these threats is becoming more and more difficult given the rate at which new variants of malware are emerging. The challenge associated with using the signature-based methods is that the problem of “looking for bad” is an unbounded one. The approach is always behind the latest, and most dangerous, threats. An additional issue is that these approaches often create a lot of “noise” in the form of false positive identification of benign content without providing any actionable insight into the potential issue to allow an individual tasked with securing the organization to be able to make an informed decision.
- One way to help minimize the number of false positive identification of benign content is by using an electronic sandbox, as shown in
FIG. 1 . Whenelectronic file 105 is received by the system, for example overnetwork 110, the file can be placed inelectronic sandbox 115.Electronic sandbox 115, as its name suggests, is an appliance that can openelectronic file 105 in total isolation.Electronic sandbox 115 can be a computer system that is physically isolated (or isolated as completely as possible) from any intranet, so as to prevent the migration of any malicious code. Alternatively,electronic sandbox 115 can be a virtual environment in a computer system, ideally isolated from any other environments on the same computer system (or other networked computer systems). - Once
electronic file 105 is opened inelectronic sandbox 115, key criteria of the operating system ofelectronic sandbox 115 can be monitored to look for any suspicious behavior that might suggest the file is infected with a malicious code. Such behavior could include, but is not limited to, trying to access the internet, changing registry settings, or attempting to elevate the user privileges. - By using
electronic sandbox 115, the dangerous effects of any malicious code inelectronic file 105 are strictly confined to the sandbox environment, which is typically discarded for a fresh instance of the environment when the next file is processed. If openingelectronic file 105 inelectronic sandbox 115 does not demonstrate the presence of any malicious code, thenelectronic file 105 is likely not a threat, and can be delivered touser 120. On the other hand, if the opening ofelectronic file 105 inelectronic sandbox 115 demonstrates the presence of malicious code, thenelectronic file 105 can be placed inquarantine 125 until eitherelectronic file 105 can be cleansed somehow of the malicious code, orelectronic file 105 is deleted. - The problem with using
electronic sandbox 115 in this manner is that it requires considerable overhead to maintainelectronic sandbox 115 and to monitor electronic sandbox to determine ifelectronic file 105 contains malicious code. In addition, monitoringelectronic file 105 withinelectronic sandbox 115 adds considerable latency to the delivery ofelectronic file 105 to the user. Finally, attackers are aware of the use ofelectronic sandbox 115. By delaying the activation time of their malicious code until after the inspection time ofelectronic sandbox 115, the observation ofelectronic sandbox 115 might fail to detect the malicious code. As a result,electronic file 105 might be delivered touser 120 as safe, even though it contains malicious code. - Embodiments of the invention address this and other problems with the prior art.
-
FIG. 1 shows an example of protection against malicious content in the prior art. -
FIG. 2 shows the electronic sandbox ofFIG. 1 , augmented by a system designed to calculate a risk assessment for an electronic file, according to an embodiment of the invention. -
FIG. 3 shows more detail about the scanner ofFIG. 2 , according to an embodiment of the invention. -
FIG. 4 shows details of the database ofFIG. 3 . -
FIG. 5 shows details of the threat calculator ofFIG. 3 . -
FIG. 6 shows details of the analyzer and statistical analyzer ofFIG. 3 when used in analysis mode. -
FIG. 7 shows a flowchart of a procedure for calculating a risk assessment for an electronic file in the system ofFIG. 3 , according to an embodiment of the invention. -
FIG. 8 shows a flowchart of alternatives to the procedure for calculating a risk assessment ofFIG. 7 , according to a second embodiment of the invention. -
FIGS. 9A-9B show a flowchart of a procedure for calculating weights used in the procedure ofFIG. 7 . -
FIGS. 10A-10B show a flowchart of a procedure for determining whether to use an electronic sandbox in the procedure ofFIG. 7 . - Because the illustrated embodiments of the present invention may for the most part be implemented using electronic components and circuits known to those skilled in the art, details will not be explained in any greater extent than that considered necessary as illustrated above, for the understanding and appreciation of the underlying concepts of embodiments of the present invention and in order not to obfuscate or distract from the teachings of embodiments of the present invention.
- Other patents and patent applications commonly assigned with this one, including U.S. Pat. Nos. 8,185,954, 8,533,824, 8,869,283 and U.S. Patent Publication No. 2013/0326624, all of which are incorporated by reference herein, describe systems and methods for determining whether the content of electronic files is known to be safe. In brief, these patents and patent applications describe systems and methods that take an electronic file and determine the format the electronic file purports to use (for example, Adobe® PDF® or Microsoft® Word). (Adobe and Adobe PDF are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Microsoft is either a registered trademark or trademark of Microsoft Corporation in the United States and/or other countries.) Once the purported format is determined, the content of the electronic file is examined to see if the content conforms to the pre-determined format. If the content conforms to the pre-determined format, then the content is permitted to pass through for delivery to the user. Otherwise, the content is quarantined. The content, whether conforming or not, can also be re-generated. Re-generation of content can further help to prevent malicious content from slipping through, by recreating the content in the pre-determined format. The re-generated electronic file ideally is structurally identical to the original file, but absent any metadata that is not required.
- Embodiments of the present invention provides an anti-malware content data management apparatus, which provides malware protection as well as insight into the threat posed by an electronic file by approaching the problem from an alternate viewpoint. The viewpoint of definable good is a bounded problem in the sense that what is known to be good for a particular file format does not change compared to trying to keep pace with the ever changing definition of known bad. It is possible to determine the goodness of files that are defined as passive: i.e., files that do not contain active of program code within them. These files are the typical files that organizations communicate on a daily basis. But these files are also the files in which new waves of attacks tend to hide within.
- By adding a further dimension of understanding, enabled by the understanding of the file content, embodiments of the present invention produces a score related to the type of content that the file in question contains, as well as the perceived risk based on historical statistics skewed with a configurable weighting factor. This approach deviates from the traditional and known art, which only provides a safe/unsafe binary answer as to the files credibility. Embodiments of the present invention extends this by providing shades of grey, to allow individuals and indeed further decision making processes to blend this information into the overall decision making process for that particular file or content thus increasing the accuracy of malware detection, as well as reducing the false positive rate.
- By extending the mantra of “looking for good” process, which maintains a rule list of many thousands of rules that enforce the currently understood criteria and by categorizing these into a subset of said rules, a collection of content groups can be realized that can then be weighted and summed to form a consistent score across a large corpus of files analyzed. The result of this score can then inform with more color than a simple good/bad decision can.
- The systems and methods described herein add a secondary layer of analytical processing over and above the approach of evaluating a file based on its conformity to known good content, which provides a binary outcome in the sense that the file is either conforming or non-conforming. This additional layer on top of this binary process allows a third outcome to an implementation whereby the original, un-sanitized version of the document is allowed to be delivered to a recipient if it is deemed a low risk.
- Examples of systems that can incorporate embodiments of the claimed invention can include the realization of an e-mail protection system whereby decisions around whether a file, typically an attachment, should be quarantined or not can be enhanced by the analytical scoring capability. In certain circumstances, specifically in a Small/Medium Enterprise (SME) environment, there is often no security expertise on-site to make the judgment call as to whether to release or permanently quarantine the file. The SME environment is typically serviced by Managed Service Security Providers (MSSP), who offer a remote managed service offering, thus allowing the organization to “out-source” its security capability to the MSSP. Therefore, any “false-positive” incidents at this level result in a costly support telephone call back to the MSSP to release the file or provide further explanation of the issue. By utilizing embodiments of the claimed invention, an automated process can be released whereby quarantined files can be subject to much more colored decision making and managed in a much more streamlined and cost effective manner.
- Another example is where the MSSP provider can remotely adjust the weightings applied to the categories to increase or decrease the importance of an associated content group on the decision making process depending on the current threat landscape and the importance of this content in the mitigation of any new and current attacks.
- Examples also include the implementation of an optimized sandbox process, which typifies the process whereby suspicious files received by an organization across a number of potential ingress point are opened, or commonly referred to as “detonated” within a controlled environment whereby any potential malware contained within said file is unable to cause any damage or spread to other environments. The current state of the art sandbox process typically observes the file for around five minutes to ascertain whether it is likely the file will perform any malicious act before then either quarantining the file or allowing it to pass on to its intended recipient. The issue with this approach that every file is processed and subject to a delay of this nature, causing significant processing overhead and bandwidth usage. Embodiments of the invention, on the other hand, optimize this process because electronic files can be scored based on the content groups contained within and by setting a threshold before the file is placed in the sandbox. If the score for the electronic file is sufficient, the sandbox can be bypassed, alleviating the necessity on every file being “detonated” by the sandbox. The sandbox infrastructure can then focus its full resources on only the files that need to be scanned as they have scored above (or below, depending on the implementation) the threshold, suggesting that there is a reason for further investigation.
-
FIG. 2 highlights how embodiments of the invention addresses these drawbacks in sandbox implementations.Electronic file 105 can be submitted to an embodiment of the invention, as represented byscanner 205, which can be inline beforesandbox 115. The process of statistical scoring can be applied toelectronic file 105 to ascertain whetherelectronic file 105 can be regenerated or not. Ifelectronic file 105 can be regenerated because it is conformant as specified by the rules relating to the format ofelectronic file 105, then the regenerated file can bypasssandbox 115 and be delivered touser 120 through whichever vector is appropriate. Ifelectronic file 105 cannot be regenerated becauseelectronic file 105 does not comply with the rules set down by the file format specification, thenelectronic file 105 can be forwarded tosandbox 115. Embodiments of the invention therefore have the effect of acting as a noise filter and only requiringsandbox 115 to be instantiated on a limited number of files that have issues that have non-conformancy problems or those that have an associated policy violation. It should be obvious to those skilled in the art that this optimizing filter has considerable benefit to the overall process in terms of both performance and overhead. - Although file conformancy policies can be drafted directly in
scanner 205,network connection 110 can also be used to remotely administer file conformancy policies. These policies determine the type of non-conformances within a file that will causescanner 205 to deem the file as non-conforming and therefore forward the file tosandbox 115. By changing the policies used byscanner 205, load balancing can be realized, whereby during times of peak demand or indeed peak malware activity the bias between delivering an electronic file directly touser 120 or detonatingelectronic file 105 insandbox 115 can be varied. These polices can be determined based on organizational preference of state and mediated by current malware activity. -
FIG. 3 shows more detail about the scanner ofFIG. 2 , according to an embodiment of the invention.Scanner 205 can include acomputer 305, which can be suitably programmed to implement embodiments of the invention. Alternatively,computer 305 can include special-purpose components designed to implement embodiments of the invention. -
Computer 305 can includereceiver 310,analyzer 315, andthreat calculator 320.Receiver 310 can receive data, such as the electronic file being examined, or weights used for categories of checks.Analyzer 315 can analyze an electronic document to see if the content of the electronic document conforms to the format of the electronic document. As described above, the checks associated with determining whether content is known to be good can be organized into various categories. There can be thousands of checks, organized into various categories.Analyzer 315 uses these checks, as organized, to determine whether the electronic file conforms to the format expected for the electronic file.Analyzer 315 can produce a report that identifies which checks do not return the expected results, and to which categories those checks belong. -
Threat calculator 320 can then take the output ofanalyzer 315 and calculate a threat score for the electronic document. For each issue identified byanalyzer 315, threat calculator can identify the corresponding weight and calculate the overall threat score by summing the products of the number of times an issue was found and the weights associated with that issue. This sum can then be compared with a threshold to determine whether the electronic file is considered to be at risk or not. - If the electronic file is considered to be at risk, then the electronic document can be detonated in
sandbox 115 as before.FIG. 3 showssandbox 115 as part of scanner 205: a person skilled in the art will recognize thatsandbox 115 can be implemented as software, in which case any suitable computer can implement the software forsandbox 115. In that case,sandbox 115 can be part ofcomputer 305. Butsandbox 115 can be separate fromscanner 205, as shown inFIG. 2 :sandbox 115 can be implemented as part of a separate computer, or as a special-purpose machine, either of which can be sufficiently isolated to prevent any malicious code in the electronic file from achieving its intended purpose. -
Computer 305 can also includestatistical analyzer 325. As described below with reference toFIG. 6 ,analyzer 315 can be used in analysis mode, operating on sets of known files.Statistical analyzer 325 can then process the results of these analyses to establish initial weights for use in determining whether an electronic file is considered to be a threat. -
Computer 305 can also includememory 330.Memory 330 can be used to store information: for example, a copy of the electronic file being scanned by the system.Memory 330 can also storedatabase 335, which can include information about the checks used to verify that the electronic file conforms to its purported file format.FIG. 4 shows more detail aboutdatabase 335. - In
FIG. 4 ,database 335 is shown as including data in three columns. (While the term “column” suggests a tabular format fordatabase 335, a person skilled in the art will recognize thatdatabase 335 can store data in any desired structure, and is not limited to tabular format.) The three columns store categories, issues, and weights. For example,database 335 shows twodifferent categories issues weights category 1 405 hasweight 1 440, whereasissue 1 415 (associated withcategory 1 405) hasweight 2 445. -
FIG. 4 actually shows different possible embodiments. In some embodiments of the invention, the categories are assigned weights, rather than the individual issues. In other embodiments of the invention, individual issues are assigned weights. Where the weights are assigned to categories, the number of issues in that category can be multiplied by the weight for the category. Where the weights are assigned to issues, the number of occurrences of each issue can be multiplied by the weight for that issue. Regardless of whether weights are per category or per issue, the sum of the products can then be computed, which represents the score for the electronic file. - Although one might think that all weights have the same sign (i.e., all are positive or negative, depending on the way the pre-determined threshold is used), no such limitation actually exists. Parties that create malicious content typically want their malicious content to achieve its objective: be it damage a computer system, extract and transmit data back to the malicious content creator, or convert computers into zombies (computers that are controlled by people other than the normally expected users), among other possibilities. The more suspicious a file looks, the less likely it is that any malicious content will achieve its objective. Thus, it is reasonable to expect that a file that has malicious content has relatively few other issues associated with it. For this reason, some issues that are not typically associated with malicious content can be assigned weights of opposite sign, thereby reducing the likelihood that the electronic file is considered a risk. For example, positive weights can be assigned to less significant issues and negative weights can be assigned to more significant issues, and a threat score that is less than the pre-determined threshold can indicate an electronic file is considered a threat. The use of weights of mixed signs can also impact the pre-determined threshold to use. For example, in one embodiment of the invention, the pre-determined threshold can be zero.
-
FIG. 5 shows details of the threat calculator ofFIG. 3 . As discussed above, a threat score can be calculated for an electronic file. Embodiments of the invention can check to see whether an electronic file conforms to its purported file format. For a given purported file format, checks can be performed to see if the electronic file meets the standard for that file format. If a particular check is not satisfied—that is, the electronic file fails to satisfy some element of the standard for that file format—then that issue is flagged as having occurred.Threat calculator 320 can takeelectronic file 105 anddatabase 305, and calculate risk assessment 505 (also called threat score, or simply score) forelectronic file 105. In one embodiment of the invention,risk assessment 505 is calculated by multiplying the number of occurrences of each issue by the corresponding weight for that issue, and summing the products. - Note that in some embodiments of the invention, weights are assigned to categories rather than to individual issues. In these embodiments of the invention, the system can calculate the number of occurrences of issues in each category based on the individual checks. This number can then be multiplied by the weight assigned to the category for use in the calculation of
risk assessment 505 similar to the discussion above. - One point that has not been discussed in detail is how the weights used in database are 335 assigned. Obviously, a user could manually assign the weights, or default weights established by the supplier of the system can be used. But it is also possible to automate the calculation of the initial weights. In embodiments of the invention,
analyzer 315 can run not only in a scanning mode but also in an analysis mode. In analysis mode,analyzer 315 can take files that are known, analyze those files, and generate weights from the analysis. -
FIG. 6 shows details of the analyzer and statistical analyzer ofFIG. 3 when used in analysis mode. InFIG. 6 ,analyzer 315 can receive two corpuses of files, such ascorpus Analyzer 315 can then analyzecorpuses results corpus 605 can include files that are known to include malicious content, whereascorpus 610 can include files that are known to have issues but are otherwise not a threat.Statistical analyzer 325 can then process theseresults Statistical analyzer 325 can use any desired algorithm to adjust weights. In some embodiments of the invention, the weights are adjusted until the threat scores for files incorpus 605 indicate a greater risk than the threat scores for files incorpus 610. - Even after initial weights have been determined, users might choose to adjust the weights. For example, one user of such a system might decide that macros included in a document are considered safe, even though macros can be used to achieve malicious results. Another user of such a system might decide that a misnamed font indicates a significant risk, even though the name of the font generally cannot be used to malicious impact. Thus, the default weights can be overwritten by users (or alternatively, at the user's direction, but by the manufacturer of the system).
- The above description of
FIG. 6 might suggest that the use ofanalyzer 315 in analysis mode can only occur to determine the initial weights used by the system. And in some embodiments of the invention,analyzer 315 is used in analysis mode only before the system is put into operation to protect a customer. But there is no reason that the results of analyzing an electronic file byanalyzer 315, even during use of the system to protect a customer, cannot be used to adjust the weights. For example, when electronic files are analyzed byanalyzer 315, the system (either directly or using statistical analyzer 325) can use these analyses as feedback to adjust the weights assigned to the categories or checks/issues. This feedback can occur in any desired manner. For example, the feedback can be applied for each electronic file analyzed byanalyzer 315, regardless of the results of the analysis. Or, the feedback can be applied only when a file is considered to be a risk, or when a file is considered to be safe. A person of ordinary skill in the art will recognize other ways in which feedback can be managed. - The above description implies that every weight in the database is adjusted. While this implication can be true, it is not required. It can occur that only some of the weights are adjusted: perhaps only one weight is adjusted. It can also occur that the result of
statistical analyzer 325 determines that the initial weights are satisfactory and require no adjustment. Embodiments of the invention are intended to encompass all such variations. -
FIG. 7 shows a flowchart of a procedure for calculating a risk assessment for an electronic file in the system ofFIG. 3 , according to an embodiment of the invention. InFIG. 7 , atblock 705, the system can receive an electronic file. Atblock 710, the system can analyze the electronic file using various checks organized into categories. Atblock 715, the system can determine weights for the various categories (or, alternatively as described above, the checks/issues themselves). Atblock 720, the system can calculate a risk assessment or threat score for the electronic file, using the checks and categories, and the associated weights. Finally, atblock 725, the system can use the calculated risk assessment to adjust the weights, for example, in a feedback loop. -
FIG. 8 shows a flowchart of alternatives to the procedure for calculating a risk assessment ofFIG. 7 , according to a second embodiment of the invention. As discussed above, weights can be assigned, not to the categories of checks, but to the checks themselves. Instead ofblocks FIG. 7 , blocks 805, 810, and 815 can be substituted. Inblock 805, the electronic file can be analyzed using individual checks. Atblock 810, weights for the individual checks can be determined. And atblock 815, the system can calculate a risk assessment or threat score based on the checks and the weights assigned to them. -
FIGS. 9A-9B show a flowchart of a procedure for calculating weights used in the procedure ofFIG. 7 . The weights discussed inFIGS. 9A-9B can be either for the categories of checks or for the individual checks. InFIG. 9A , atblock 905, weights can be assigned by the user. Alternatively, atblock 910, default weights can be assigned. Atblock 915, the default weights can be adjusted by the user. - In
FIG. 9B , to determine the default weights (or as a replacement for default weights provided in some other manner), weights can be calculated by analyzing known files. Atblock 920, the system can receive corpuses of files. As described above, in some embodiments of the invention, one corpus can include files known to contain malicious content, and another corpus can include files with issues that are known not to be a threat. Atblock 925, the corpuses of files can be scanned using the checks/categories of checks. Atblock 930, the results of the analysis can be statistically analyzed. And atblock 935, the default weights can be adjusted using the statistical analysis. Control can then return toFIG. 9A , where processing ends. -
FIGS. 10A-10B show a flowchart of a procedure for determining whether to use an electronic sandbox in the procedure ofFIG. 7 . InFIG. 10A , atblock 1005, the system can calculate a threat score for an electronic file. Atblock 1010, the system can compare the threat score with a pre-determined threshold. Atblock 1015, the system determines if the threat score exceeds the pre-determined threshold. If so, then atblock 1020 the electronic file is considered safe and atblock 1025 the system can deliver the electronic file to the intended recipient. - If the threat score does not exceed the pre-determined threshold, then at block 1030 (
FIG. 10B ), the system can note that the electronic file is not considered safe. Atblock 1035, the system can place the electronic file in a sandbox. Atblock 1040, the system can detonate the electronic file (in any appropriate manner), and atblock 1045, the system can observe the operation of the sandbox. Atblock 1050, the system determines if the electronic file appears to be a threat. If so, then atblock 1055, the system can quarantine the file until appropriate remedies can be applied. Otherwise, processing can return to block 1025 (FIG. 10A ) to have the system deliver the electronic file to the intended recipient. - Although
FIGS. 10A-10B describe an electronic file as considered safe when the threat score exceeds the pre-determined threshold, a person of ordinary skill in the art will recognize that the test for whether an electronic file is considered safe or not can depend on how the threat score is calculated. Thus, if positive weights are used for issues that are considered more significant, an electronic file can be considered safe if the threat score is less than a pre-determined threshold, and can be considered a risk if the threat score is greater than the pre-determined threshold. - The above flowcharts show some possible embodiments of the invention. But other embodiments of the invention can organize the blocks in different arrangements, and can include or omit different blocks as desired, or repeat a block (or multiple blocks) as needed. Embodiments of the invention are intended to include all such variations on the flowcharts, whether or not explicitly shown or described.
- The following discussion is intended to provide a brief, general description of a suitable machine in which certain aspects of the invention may be implemented. Typically, the machine includes a system bus to which is attached processors, memory, e.g., random access memory (RAM), read-only memory (ROM), or other state preserving medium, storage devices, a video interface, and input/output interface ports. The machine may be controlled, at least in part, by input from conventional input devices, such as keyboards, mice, etc., as well as by directives received from another machine, interaction with a virtual reality (VR) environment, biometric feedback, or other input signal. As used herein, the term “machine” is intended to broadly encompass a single machine, or a system of communicatively coupled machines or devices operating together. Exemplary machines include computing devices such as personal computers, workstations, servers, portable computers, handheld devices, telephones, tablets, etc., as well as transportation devices, such as private or public transportation, e.g., automobiles, trains, cabs, etc.
- The machine may include embedded controllers, such as programmable or non-programmable logic devices or arrays, Application Specific Integrated Circuits, embedded computers, smart cards, and the like. The machine may utilize one or more connections to one or more remote machines, such as through a network interface, modem, or other communicative coupling. Machines may be interconnected by way of a physical and/or logical network, such as an intranet, the Internet, local area networks, wide area networks, etc. One skilled in the art will appreciated that network communication may utilize various wired and/or wireless short range or long range carriers and protocols, including radio frequency (RF), satellite, microwave, Institute of Electrical and Electronics Engineers (IEEE) 810.11, Bluetooth, optical, infrared, cable, laser, etc.
- The invention may be described by reference to or in conjunction with associated data including functions, procedures, data structures, application programs, etc. which when accessed by a machine results in the machine performing tasks or defining abstract data types or low-level hardware contexts. Associated data may be stored on tangible computer-readable media as non-transitory computer-executable instructions. Associated data may be stored in, for example, the volatile and/or non-volatile memory, e.g., RAM, ROM, etc., or in other storage devices and their associated storage media, including hard-drives, floppy-disks, optical storage, tapes, flash memory, memory sticks, digital video disks, biological storage, etc. Associated data may be delivered over transmission environments, including the physical and/or logical network, in the form of packets, serial data, parallel data, propagated signals, etc., and may be used in a compressed or encrypted format. Associated data may be used in a distributed environment, and stored locally and/or remotely for machine access.
- Having described and illustrated the principles of the invention with reference to illustrated embodiments, it will be recognized that the illustrated embodiments may be modified in arrangement and detail without departing from such principles. And, though the foregoing discussion has focused on particular embodiments, other configurations are contemplated. In particular, even though expressions such as “in one embodiment” or the like are used herein, these phrases are meant to generally reference embodiment possibilities, and are not intended to limit the invention to particular embodiment configurations. As used herein, these terms may reference the same or different embodiments that are combinable into other embodiments.
- Embodiments of the invention can extend to the following statements, without limitation:
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, for each of the plurality of categories, a weight assigned to the category, and for each of the plurality of checks, a second weight assigned to the check; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer, the weights assigned to the plurality of categories, and the second weights assigned to the plurality of checks.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the receiver is operative to receive the weights assigned to the plurality of categories from a user.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the weights assigned to the plurality of categories include default weights assigned to the plurality of categories, and wherein the receiver is operative to receive second weights from a user to assign to the plurality of categories.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the weights assigned to the plurality of categories include default weights assigned to the plurality of categories, wherein the analyzer is operative to analyze a first corpus of files with known non-conformities to produce a first result and to analyze a second corpus of safe files to produce a second result, and wherein the system further comprises a statistical analyzer to statistically review the first result and the second result and to adjust the default weights assigned to the plurality of categories so that a first calculated risk assessment for the first corpus of files is higher than a second calculated risk assessment for the second corpus of files.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, and a statistical analyzer to use the result from the analyzer adjust the weights.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, wherein the system is operative to deliver the electronic file to a second user if the calculated risk assessment is greater than a pre-determined threshold.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, and an electronic sandbox, the electronic file placed in the electronic sandbox if the risk assessment for the file does not exceed a pre-determined threshold.
- An embodiment of the invention includes a system, comprising a computer; a memory in the computer; a database stored in the memory, the database including: a plurality of checks organized into a plurality of categories, and for each of the plurality of categories, a weight assigned to the category; a receiver to receive an electronic file; an analyzer to analyze the electronic file using the plurality of checks in the database; a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories, and an electronic sandbox, the electronic file placed in the electronic sandbox if the risk assessment for the file does not exceed a pre-determined threshold, wherein the system is operative to deliver the electronic file to a second user if an observed operation of the electronic sand box indicates that the electronic file is not a threat.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks from one of a plurality of categories to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of checks from one of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of checks from the one of the categories and the second weights assigned to each of the plurality of checks.
- An embodiment of the invention includes a method, comprising: receiving the weight assigned to each of the plurality of categories from a user; receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories, and adjusting the default weight assigned to each of the plurality of categories according to instruction from a user; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, wherein receiving a default weight to assign to each of the plurality of categories includes receiving a first corpus of files with known non-conformities and a second corpus of safe files, scanning the first corpus of files to produce a first result and the second corpus of files to produce a second result, statistically analyzing the first result and the second result, and using the analysis of the first result and the second result to adjust the default weight assigned to each of the plurality of categories so that a first calculated risk assessment for the first corpus of files is higher than a second calculated risk assessment for the second corpus of files.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories; and using the final risk assessment of the electronic file to adjust the weights assigned to each of the plurality of categories.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, and if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user, and if the threat score does not exceed the threshold score, determining that the electronic file is likely a threat.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user, and if the threat score does not exceed the threshold score, determining that the electronic file is likely a threat, wherein determining that the electronic file is likely a threat includes placing the electronic file in a sandbox, detonating the electronic file in the sandbox, and observing the operation of the sandbox after detonating the electronic file.
- An embodiment of the invention includes a method, comprising: receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, including calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories, comparing the threat score with a threshold score, if the threat score exceeds the threshold score determining that the electronic file is likely not a threat and delivering the electronic file to a user, and if the threat score does not exceed the threshold score, determining that the electronic file is likely a threat, wherein determining that the electronic file is likely a threat includes placing the electronic file in a sandbox, detonating the electronic file in the sandbox, observing the operation of the sandbox after detonating the electronic file, and if the observed operation of the sandbox indicates that the electronic file is not a threat, delivering the electronic file to the user.
- An embodiment of the invention includes a tangible computer-readable medium storing non-transitory instruction that, when executed by a machine, implement the method of receiving an electronic file; analyzing the electronic file using a plurality of checks to determine if the electronic file conforms to an expected format, the plurality of checks organized into a plurality of categories; determining a weight for each of the plurality of categories; and calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories.
- Consequently, in view of the wide variety of permutations to the embodiments described herein, this detailed description and accompanying material is intended to be illustrative only, and should not be taken as limiting the scope of the invention. What is claimed as the invention, therefore, is all such modifications as can come within the scope and spirit of the following claims and equivalents thereto.
Claims (21)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/634,654 US10360388B2 (en) | 2014-11-26 | 2017-06-27 | Statistical analytic method for the determination of the risk posed by file based content |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201462084832P | 2014-11-26 | 2014-11-26 | |
US14/600,431 US9330264B1 (en) | 2014-11-26 | 2015-01-20 | Statistical analytic method for the determination of the risk posed by file based content |
US15/082,791 US9729564B2 (en) | 2014-11-26 | 2016-03-28 | Statistical analytic method for the determination of the risk posed by file based content |
US15/634,654 US10360388B2 (en) | 2014-11-26 | 2017-06-27 | Statistical analytic method for the determination of the risk posed by file based content |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/082,791 Continuation US9729564B2 (en) | 2014-11-26 | 2016-03-28 | Statistical analytic method for the determination of the risk posed by file based content |
Publications (2)
Publication Number | Publication Date |
---|---|
US20170293764A1 true US20170293764A1 (en) | 2017-10-12 |
US10360388B2 US10360388B2 (en) | 2019-07-23 |
Family
ID=55807530
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/600,431 Active US9330264B1 (en) | 2014-11-26 | 2015-01-20 | Statistical analytic method for the determination of the risk posed by file based content |
US15/082,791 Active US9729564B2 (en) | 2014-11-26 | 2016-03-28 | Statistical analytic method for the determination of the risk posed by file based content |
US15/634,654 Active US10360388B2 (en) | 2014-11-26 | 2017-06-27 | Statistical analytic method for the determination of the risk posed by file based content |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/600,431 Active US9330264B1 (en) | 2014-11-26 | 2015-01-20 | Statistical analytic method for the determination of the risk posed by file based content |
US15/082,791 Active US9729564B2 (en) | 2014-11-26 | 2016-03-28 | Statistical analytic method for the determination of the risk posed by file based content |
Country Status (11)
Country | Link |
---|---|
US (3) | US9330264B1 (en) |
EP (1) | EP3224755B1 (en) |
JP (1) | JP6450845B2 (en) |
CN (1) | CN107004090A (en) |
AU (1) | AU2015352524B2 (en) |
CA (1) | CA2968896A1 (en) |
DK (1) | DK3224755T3 (en) |
ES (1) | ES2846810T3 (en) |
MY (1) | MY189945A (en) |
TW (1) | TW201640384A (en) |
WO (1) | WO2016083447A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11157644B1 (en) * | 2020-12-15 | 2021-10-26 | DataMover LLC | Systems and methods of secure networked data exchange |
Families Citing this family (23)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9729513B2 (en) | 2007-11-08 | 2017-08-08 | Glasswall (Ip) Limited | Using multiple layers of policy management to manage risk |
US9330264B1 (en) | 2014-11-26 | 2016-05-03 | Glasswall (Ip) Limited | Statistical analytic method for the determination of the risk posed by file based content |
US10229219B2 (en) * | 2015-05-01 | 2019-03-12 | Facebook, Inc. | Systems and methods for demotion of content items in a feed |
US10192058B1 (en) * | 2016-01-22 | 2019-01-29 | Symantec Corporation | System and method for determining an aggregate threat score |
US10200395B1 (en) * | 2016-03-30 | 2019-02-05 | Symantec Corporation | Systems and methods for automated whitelisting of files |
US20170353475A1 (en) | 2016-06-06 | 2017-12-07 | Glasswall (Ip) Limited | Threat intelligence cloud |
WO2018039792A1 (en) * | 2016-08-31 | 2018-03-08 | Wedge Networks Inc. | Apparatus and methods for network-based line-rate detection of unknown malware |
US9858424B1 (en) | 2017-01-05 | 2018-01-02 | Votiro Cybersec Ltd. | System and method for protecting systems from active content |
US10331890B2 (en) | 2017-03-20 | 2019-06-25 | Votiro Cybersec Ltd. | Disarming malware in protected content |
US10331889B2 (en) | 2017-01-05 | 2019-06-25 | Votiro Cybersec Ltd. | Providing a fastlane for disarming malicious content in received input content |
US10013557B1 (en) | 2017-01-05 | 2018-07-03 | Votiro Cybersec Ltd. | System and method for disarming malicious code |
US11423140B1 (en) * | 2017-03-27 | 2022-08-23 | Melih Abdulhayoglu | Auto-containment of guest user applications |
US10951644B1 (en) | 2017-04-07 | 2021-03-16 | Comodo Security Solutions, Inc. | Auto-containment of potentially vulnerable applications |
TWI650670B (en) * | 2017-09-08 | 2019-02-11 | 中華電信股份有限公司 | Gateway apparatus, non-transitory computer readable medium and purging method for malicious document file |
US10778713B2 (en) | 2018-02-26 | 2020-09-15 | International Business Machines Corporation | Method and system to manage risk of vulnerabilities and corresponding change actions to address malware threats |
US10956568B2 (en) * | 2018-04-30 | 2021-03-23 | Mcafee, Llc | Model development and application to identify and halt malware |
CN109194739B (en) * | 2018-09-03 | 2023-06-13 | 中国平安人寿保险股份有限公司 | File uploading method, storage medium and server |
US11005739B2 (en) | 2018-09-05 | 2021-05-11 | Richard K. Steen | System and method for managing and presenting network data |
US10467419B1 (en) * | 2018-10-31 | 2019-11-05 | Capital One Services, Llc | Methods and systems for determining software risk scores |
EP3899767A4 (en) * | 2018-12-19 | 2022-08-03 | Hewlett-Packard Development Company, L.P. | Security detection analytics |
US11386205B2 (en) * | 2019-01-14 | 2022-07-12 | Mcafee, Llc | Detection of malicious polyglot files |
KR102284646B1 (en) * | 2019-10-25 | 2021-08-03 | 소프트캠프 주식회사 | Malignant code of macro in document detect method and system |
EP4285257A1 (en) | 2021-01-29 | 2023-12-06 | Glasswall (IP) Limited | Machine learning methods and systems for determining file risk using content disarm and reconstruction analysis |
Family Cites Families (105)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5050212A (en) | 1990-06-20 | 1991-09-17 | Apple Computer, Inc. | Method and apparatus for verifying the integrity of a file stored separately from a computer |
US5649095A (en) | 1992-03-30 | 1997-07-15 | Cozza; Paul D. | Method and apparatus for detecting computer viruses through the use of a scan information cache |
US5655130A (en) | 1994-10-14 | 1997-08-05 | Unisys Corporation | Method and apparatus for document production using a common document database |
US5745897A (en) | 1994-11-21 | 1998-04-28 | Bay Networks Group, Inc. | Method and system for compiling management information base specifications |
NL1000669C2 (en) | 1995-06-26 | 1996-12-31 | Nederland Ptt | Method and devices for transferring data with control for transmission errors. |
US6493761B1 (en) | 1995-12-20 | 2002-12-10 | Nb Networks | Systems and methods for data processing using a protocol parsing engine |
US5832208A (en) | 1996-09-05 | 1998-11-03 | Cheyenne Software International Sales Corp. | Anti-virus agent for use with databases and mail servers |
US6144934A (en) | 1996-09-18 | 2000-11-07 | Secure Computing Corporation | Binary filter using pattern recognition |
US5951698A (en) | 1996-10-02 | 1999-09-14 | Trend Micro, Incorporated | System, apparatus and method for the detection and removal of viruses in macros |
US8225408B2 (en) | 1997-11-06 | 2012-07-17 | Finjan, Inc. | Method and system for adaptive rule-based content scanners |
US6807632B1 (en) | 1999-01-21 | 2004-10-19 | Emc Corporation | Content addressable information encapsulation, representation, and transfer |
JPH11224190A (en) | 1998-02-09 | 1999-08-17 | Yaskawa Electric Corp | Method for protecting computer connected to computer network, and recording medium having recorded program therefor |
US6401210B1 (en) | 1998-09-23 | 2002-06-04 | Intel Corporation | Method of managing computer virus infected files |
US6336124B1 (en) | 1998-10-01 | 2002-01-01 | Bcl Computers, Inc. | Conversion data representing a document to other formats for manipulation and display |
US6519702B1 (en) | 1999-01-22 | 2003-02-11 | Sun Microsystems, Inc. | Method and apparatus for limiting security attacks via data copied into computer memory |
US7391865B2 (en) | 1999-09-20 | 2008-06-24 | Security First Corporation | Secure data parser method and system |
WO2001026004A2 (en) | 1999-10-04 | 2001-04-12 | Kana Communications, Inc. | Method and apparatus for interprocess messaging and its use for automatically generating transactional email |
US6697950B1 (en) | 1999-12-22 | 2004-02-24 | Networks Associates Technology, Inc. | Method and apparatus for detecting a macro computer virus using static analysis |
DE60122033D1 (en) | 2000-02-04 | 2006-09-21 | Aladdin Knowledge Systems Ltd | Protection of computer networks against malicious content |
US7225181B2 (en) | 2000-02-04 | 2007-05-29 | Fujitsu Limited | Document searching apparatus, method thereof, and record medium thereof |
US7093135B1 (en) | 2000-05-11 | 2006-08-15 | Cybersoft, Inc. | Software virus detection methods and apparatus |
GB2357939B (en) | 2000-07-05 | 2002-05-15 | Gfi Fax & Voice Ltd | Electronic mail message anti-virus system and method |
GB0016835D0 (en) | 2000-07-07 | 2000-08-30 | Messagelabs Limited | Method of, and system for, processing email |
US7636945B2 (en) | 2000-07-14 | 2009-12-22 | Computer Associates Think, Inc. | Detection of polymorphic script language viruses by data driven lexical analysis |
US6895011B1 (en) | 2000-08-15 | 2005-05-17 | Lucent Technologies Inc. | Method and apparatus for re-sequencing data packets |
GB2366706B (en) | 2000-08-31 | 2004-11-03 | Content Technologies Ltd | Monitoring electronic mail messages digests |
JP4415232B2 (en) | 2000-10-12 | 2010-02-17 | ソニー株式会社 | Information processing apparatus and method, and program recording medium |
US7669051B2 (en) * | 2000-11-13 | 2010-02-23 | DigitalDoors, Inc. | Data security system and method with multiple independent levels of security |
US7322047B2 (en) * | 2000-11-13 | 2008-01-22 | Digital Doors, Inc. | Data security system and method associated with data mining |
US9311499B2 (en) | 2000-11-13 | 2016-04-12 | Ron M. Redlich | Data security system and with territorial, geographic and triggering event protocol |
JP2002259187A (en) | 2001-03-01 | 2002-09-13 | Nec Corp | Attachable/detachable file monitoring system aiming at detection and elimination of abnormal file |
US6895383B2 (en) * | 2001-03-29 | 2005-05-17 | Accenture Sas | Overall risk in a system |
US7058858B2 (en) | 2001-04-23 | 2006-06-06 | Hewlett-Packard Development Company, L.P. | Systems and methods for providing automated diagnostic services for a cluster computer system |
US6895534B2 (en) | 2001-04-23 | 2005-05-17 | Hewlett-Packard Development Company, L.P. | Systems and methods for providing automated diagnostic services for a cluster computer system |
US8095597B2 (en) | 2001-05-01 | 2012-01-10 | Aol Inc. | Method and system of automating data capture from electronic correspondence |
US7502829B2 (en) | 2001-06-21 | 2009-03-10 | Cybersoft, Inc. | Apparatus, methods and articles of manufacture for intercepting, examining and controlling code, data and files and their transfer |
US7526572B2 (en) | 2001-07-12 | 2009-04-28 | Research In Motion Limited | System and method for providing remote data access for a mobile communication device |
WO2003007184A1 (en) | 2001-07-12 | 2003-01-23 | Research In Motion Limited | System and method for pushing data from an information source to a mobile communication device including transcoding of the data |
US7487544B2 (en) | 2001-07-30 | 2009-02-03 | The Trustees Of Columbia University In The City Of New York | System and methods for detection of new malicious executables |
US6947947B2 (en) | 2001-08-17 | 2005-09-20 | Universal Business Matrix Llc | Method for adding metadata to data |
US20040008368A1 (en) | 2001-09-07 | 2004-01-15 | Plunkett Michael K | Mailing online operation flow |
US20030079142A1 (en) | 2001-10-22 | 2003-04-24 | Aladdin Knowledge Systems Ltd. | Classifying digital object security category |
US20030079158A1 (en) | 2001-10-23 | 2003-04-24 | Tower James Brian | Secured digital systems and a method and software for operating the same |
JP3992136B2 (en) * | 2001-12-17 | 2007-10-17 | 学校法人金沢工業大学 | Virus detection method and apparatus |
US7363506B2 (en) | 2002-01-30 | 2008-04-22 | Cybersoft, Inc. | Software virus detection methods, apparatus and articles of manufacture |
US6922827B2 (en) | 2002-02-22 | 2005-07-26 | Bea Systems, Inc. | Iterative software development environment with prioritized build rules |
US20030163732A1 (en) | 2002-02-28 | 2003-08-28 | Parry Travis J. | Device-specific firewall |
US7171691B2 (en) * | 2002-04-10 | 2007-01-30 | International Business Machines Corporation | Content sanitation via transcoding |
US20030229810A1 (en) | 2002-06-05 | 2003-12-11 | Bango Joseph J. | Optical antivirus firewall for internet, LAN, and WAN computer applications |
US7240279B1 (en) | 2002-06-19 | 2007-07-03 | Microsoft Corporation | XML patterns language |
DE10235819B4 (en) | 2002-08-05 | 2005-12-01 | Utz Schneider | Method and arrangement for blocking data sent to a user and / or information and / or signals of electronic media and their use |
GB2391965B (en) | 2002-08-14 | 2005-11-30 | Messagelabs Ltd | Method of, and system for, heuristically detecting viruses in executable code |
US8335779B2 (en) | 2002-08-16 | 2012-12-18 | Gamroe Applications, Llc | Method and apparatus for gathering, categorizing and parameterizing data |
US7020804B2 (en) | 2002-12-03 | 2006-03-28 | Lockheed Martin Corporation | Test data generation system for evaluating data cleansing applications |
US7644361B2 (en) | 2002-12-23 | 2010-01-05 | Canon Kabushiki Kaisha | Method of using recommendations to visually create new views of data across heterogeneous sources |
US8533840B2 (en) * | 2003-03-25 | 2013-09-10 | DigitalDoors, Inc. | Method and system of quantifying risk |
US20050071477A1 (en) | 2003-03-27 | 2005-03-31 | Microsoft Corporation | Providing information links via a network |
US7269733B1 (en) | 2003-04-10 | 2007-09-11 | Cisco Technology, Inc. | Reliable embedded file content addressing |
GB2400933B (en) | 2003-04-25 | 2006-11-22 | Messagelabs Ltd | A method of, and system for, heuristically detecting viruses in executable code by detecting files which have been maliciously altered |
US20040230896A1 (en) | 2003-05-16 | 2004-11-18 | Dethe Elza | Method and system for enabling collaborative authoring of hierarchical documents with unique node identifications |
US20040240472A1 (en) | 2003-05-28 | 2004-12-02 | Alok Kumar | Method and system for maintenance of packet order using caching |
EP1652033A1 (en) | 2003-07-08 | 2006-05-03 | Seventh Knight | Automatic regeneration of computer files description |
US20050081057A1 (en) | 2003-10-10 | 2005-04-14 | Oded Cohen | Method and system for preventing exploiting an email message |
US8239687B2 (en) | 2003-11-12 | 2012-08-07 | The Trustees Of Columbia University In The City Of New York | Apparatus method and medium for tracing the origin of network transmissions using n-gram distribution of data |
US7467409B2 (en) | 2003-12-12 | 2008-12-16 | Microsoft Corporation | Aggregating trust services for file transfer clients |
US7475427B2 (en) | 2003-12-12 | 2009-01-06 | International Business Machines Corporation | Apparatus, methods and computer programs for identifying or managing vulnerabilities within a data processing network |
US20050149720A1 (en) | 2004-01-07 | 2005-07-07 | Shimon Gruper | Method for speeding up the pass time of an executable through a checkpoint |
US7721334B2 (en) | 2004-01-30 | 2010-05-18 | Microsoft Corporation | Detection of code-free files |
US7512658B2 (en) | 2004-02-26 | 2009-03-31 | International Business Machines Corporation | Providing a portion of an electronic mail message based upon a transfer rate, a message size, and a file format |
US7607172B2 (en) | 2004-03-02 | 2009-10-20 | International Business Machines Corporation | Method of protecting a computing system from harmful active content in documents |
US8186026B2 (en) | 2004-03-03 | 2012-05-29 | Rockstar Bidco, LP | Technique for maintaining secure network connections |
US7451394B2 (en) | 2004-04-30 | 2008-11-11 | Convergys Cmg Utah | System and method for document and data validation |
US7444521B2 (en) | 2004-07-16 | 2008-10-28 | Red Hat, Inc. | System and method for detecting computer virus |
GB0418066D0 (en) | 2004-08-13 | 2004-09-15 | Ibm | A prioritization system |
US20060044605A1 (en) | 2004-08-24 | 2006-03-02 | Schneider Charles R | Systems, methods and computer program products for labeled forms processing |
US7810035B2 (en) * | 2004-10-15 | 2010-10-05 | Microsoft Corporation | Browsing web content using predictive navigation links |
WO2006047163A2 (en) | 2004-10-26 | 2006-05-04 | Priderock, L.L.C. | System and method for identifying and removing malware on a computer system |
US10043008B2 (en) | 2004-10-29 | 2018-08-07 | Microsoft Technology Licensing, Llc | Efficient white listing of user-modifiable files |
US7636856B2 (en) | 2004-12-06 | 2009-12-22 | Microsoft Corporation | Proactive computer malware protection through dynamic translation |
US8037534B2 (en) | 2005-02-28 | 2011-10-11 | Smith Joseph B | Strategies for ensuring that executable content conforms to predetermined patterns of behavior (“inverse virus checking”) |
US7854007B2 (en) | 2005-05-05 | 2010-12-14 | Ironport Systems, Inc. | Identifying threats in electronic messages |
US20060272006A1 (en) | 2005-05-27 | 2006-11-30 | Shaohong Wei | Systems and methods for processing electronic data |
GB2427048A (en) | 2005-06-09 | 2006-12-13 | Avecho Group Ltd | Detection of unwanted code or data in electronic mail |
US20070056035A1 (en) | 2005-08-16 | 2007-03-08 | Drew Copley | Methods and systems for detection of forged computer files |
US20070067397A1 (en) | 2005-09-19 | 2007-03-22 | Available For Licensing | Systems and methods for sharing documents |
US7756834B2 (en) | 2005-11-03 | 2010-07-13 | I365 Inc. | Malware and spyware attack recovery system and method |
GB2444514A (en) | 2006-12-04 | 2008-06-11 | Glasswall | Electronic file re-generation |
US8468244B2 (en) * | 2007-01-05 | 2013-06-18 | Digital Doors, Inc. | Digital information infrastructure and method for security designated data and with granular data stores |
US9152789B2 (en) | 2008-05-28 | 2015-10-06 | Zscaler, Inc. | Systems and methods for dynamic cloud-based malware behavior analysis |
US8595282B2 (en) * | 2008-06-30 | 2013-11-26 | Symantec Corporation | Simplified communication of a reputation score for an entity |
US8997219B2 (en) | 2008-11-03 | 2015-03-31 | Fireeye, Inc. | Systems and methods for detecting malicious PDF network content |
US8181251B2 (en) * | 2008-12-18 | 2012-05-15 | Symantec Corporation | Methods and systems for detecting malware |
US8683584B1 (en) * | 2009-04-25 | 2014-03-25 | Dasient, Inc. | Risk assessment |
US9009820B1 (en) | 2010-03-08 | 2015-04-14 | Raytheon Company | System and method for malware detection using multiple techniques |
US10397246B2 (en) | 2010-07-21 | 2019-08-27 | Radware, Ltd. | System and methods for malware detection using log based crowdsourcing analysis |
JP5569935B2 (en) * | 2010-07-23 | 2014-08-13 | 日本電信電話株式会社 | Software detection method, apparatus and program |
US20130006701A1 (en) * | 2011-07-01 | 2013-01-03 | International Business Machines Corporation | Assessing and managing risks of service related changes based on dynamic context information |
US20130074143A1 (en) | 2011-09-15 | 2013-03-21 | Mcafee, Inc. | System and method for real-time customized threat protection |
US9177142B2 (en) * | 2011-10-14 | 2015-11-03 | Trustwave Holdings, Inc. | Identification of electronic documents that are likely to contain embedded malware |
US9213837B2 (en) * | 2011-12-06 | 2015-12-15 | Raytheon Cyber Products, Llc | System and method for detecting malware in documents |
CN102571767A (en) * | 2011-12-24 | 2012-07-11 | 成都市华为赛门铁克科技有限公司 | File type recognition method and file type recognition device |
US8813239B2 (en) * | 2012-01-17 | 2014-08-19 | Bitdefender IPR Management Ltd. | Online fraud detection dynamic scoring aggregation systems and methods |
US9674211B2 (en) * | 2013-01-30 | 2017-06-06 | Skyhigh Networks, Inc. | Cloud service usage risk assessment using darknet intelligence |
GB2518880A (en) | 2013-10-04 | 2015-04-08 | Glasswall Ip Ltd | Anti-Malware mobile content data management apparatus and method |
US9330264B1 (en) | 2014-11-26 | 2016-05-03 | Glasswall (Ip) Limited | Statistical analytic method for the determination of the risk posed by file based content |
-
2015
- 2015-01-20 US US14/600,431 patent/US9330264B1/en active Active
- 2015-11-25 WO PCT/EP2015/077634 patent/WO2016083447A1/en active Application Filing
- 2015-11-25 JP JP2017528182A patent/JP6450845B2/en active Active
- 2015-11-25 DK DK15801391.2T patent/DK3224755T3/en active
- 2015-11-25 ES ES15801391T patent/ES2846810T3/en active Active
- 2015-11-25 CA CA2968896A patent/CA2968896A1/en active Pending
- 2015-11-25 EP EP15801391.2A patent/EP3224755B1/en active Active
- 2015-11-25 MY MYPI2017701883A patent/MY189945A/en unknown
- 2015-11-25 TW TW104139085A patent/TW201640384A/en unknown
- 2015-11-25 CN CN201580065239.XA patent/CN107004090A/en active Pending
- 2015-11-25 AU AU2015352524A patent/AU2015352524B2/en active Active
-
2016
- 2016-03-28 US US15/082,791 patent/US9729564B2/en active Active
-
2017
- 2017-06-27 US US15/634,654 patent/US10360388B2/en active Active
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11157644B1 (en) * | 2020-12-15 | 2021-10-26 | DataMover LLC | Systems and methods of secure networked data exchange |
US20220188441A1 (en) * | 2020-12-15 | 2022-06-16 | DataMover LLC | Systems and methods of secure networked data exchange |
WO2022132658A1 (en) * | 2020-12-15 | 2022-06-23 | DataMover LLC | Systems and methods of secure networked data exchange |
US11874941B2 (en) * | 2020-12-15 | 2024-01-16 | DataMover LLC | Systems and methods of secure networked data exchange |
Also Published As
Publication number | Publication date |
---|---|
CN107004090A (en) | 2017-08-01 |
US9729564B2 (en) | 2017-08-08 |
AU2015352524B2 (en) | 2018-11-15 |
WO2016083447A1 (en) | 2016-06-02 |
AU2015352524A1 (en) | 2017-06-29 |
JP2018508054A (en) | 2018-03-22 |
EP3224755B1 (en) | 2020-11-04 |
EP3224755A1 (en) | 2017-10-04 |
US10360388B2 (en) | 2019-07-23 |
DK3224755T3 (en) | 2021-02-01 |
US20160212161A1 (en) | 2016-07-21 |
US20160147998A1 (en) | 2016-05-26 |
MY189945A (en) | 2022-03-22 |
TW201640384A (en) | 2016-11-16 |
US9330264B1 (en) | 2016-05-03 |
CA2968896A1 (en) | 2016-06-02 |
JP6450845B2 (en) | 2019-01-09 |
ES2846810T3 (en) | 2021-07-29 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10360388B2 (en) | Statistical analytic method for the determination of the risk posed by file based content | |
US10491623B2 (en) | Social network security monitoring | |
US9455981B2 (en) | Method and system for protection against information stealing software | |
US9495539B2 (en) | Method and system for protection against information stealing software | |
US20220210173A1 (en) | Contextual zero trust network access (ztna) based on dynamic security posture insights | |
EP3335145B1 (en) | Using multiple layers of policy management to manage risk | |
US8701196B2 (en) | System, method and computer program product for obtaining a reputation associated with a file | |
US20230068946A1 (en) | Integrated cybersecurity threat management | |
Kolouch et al. | Cyber security: Lessons learned from cyber-attacks on hospitals in the COVID-19 pandemic | |
Daskal et al. | Data nationalism on the rise | |
Nallaperumal | CyberSecurity Analytics to Combat Cyber Crimes | |
BerinJones | Cyber-security and combatting cyber-attacks: a study | |
Prunckun | The Rule of Law: Controlling Cyber Weapons | |
Canzani et al. | Towards an understanding of the IT security information ecosystem | |
Cormack | Processing Data to Protect Data: Resolving the Breach Detection Paradox | |
Tavolato et al. | Comparing the Effectivity of Planned Cyber Defense Controls in Order to Support the Selection Process | |
Sarowa et al. | Analysis of Cyber Attacks and Cyber Incident Patterns over APCERT Member Countries | |
Qureshi et al. | A Comprehensive Evaluation and Assessment Study of Cyber-Attacks and Cyber Security; Emerging Inclinations and Recent Expansions | |
Yazbek | Hackers and Their Companion Viruses Are An Increasing Problem, Especially on the Internet. What Are the Most Important Measurers for a Firm to Take to Protect Itself from This? Is Full Protection Feasible? Why or Why Not? | |
Daramola | The Threat and Economic Impact of Modular Malware on United States’ Critical Infrastructures and Organizations | |
Stanley | Information Security | |
Tzu | What Lies behind Chinese Cyber Warfare | |
Căpușneanu et al. | The Main Aspects of the Impact of Cybercrimes on the Business Environment in the Digital Era: Literature |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
FEPP | Fee payment procedure |
Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |